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What is claimed is: 

1. A device for filtering traffic in a computer network, comprising: 

a first processor for receiving network traffic from at least one network port, 
wherein the first processor is operatively connected to at least a private memory; 

a first filter table resident in the private memory, the first filter table containing at 
least partial traffic identification information for network traffic received from the at least 
one network port; 

a second processor for network traffic forwarded from the first processor, the 
second processor being operatively connected to the first processor through at least a 
shared memory; and 

a second filter table maintained in the shared memory, the second filter table 
containing at least partial traffic identification information for network traffic received 
from the at least one network port, 

wherein the first processor operates to filter network traffic by looking up 
identification information in the first filter table, when such identification information is 
not found in the first filter table, the network traffic is forwarded to the second processor. 

2. The device of claim 1, wherein the first filter table is in the form of a balanced 
binary tree. 

3. The device of claim 1, wherein the content and format of the first filter table are 
maintained by the second processor. 

4. The device of claim 1, wherein the network traffic identification information 
comprises at least source and destination addresses. 

5. The device of claim 2, wherein the source and destination addresses further 
comprise media access control addresses unique to particular network devices. 
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6. A method for filtering traffic in a computer network, comprising the steps of: 
receiving, into a first processor, a data packet received at a network port; 
extracting packet identification information from the data packet; 
determining whether the extracted packet identification information is contained 

within a first filter table maintained within a private memory operatively connected to the 
first processor; 

forwarding the data packet to a second processor if it is determined that the 
extracted packet identification information is not contained within the first filter table; 
and 

determining whether the extracted packet identification information is contained 
within a second filter table maintained within a shared memory operatively connected to 
both the first processor and the second processor; 

7. The method of claim 6, wherein the data packet identification information 
includes a source address and at least one destination address relating to unique network 
devices. 

8. The method of claim 7, wherein the source and destination addresses are media 
access control addresses. 

9. The method of claim 7, wherein the step of determining whether the extracted 
packet information is contained within a first filter table further comprises the steps of: 

determining whether the first filter table includes the at least one extracted 
destination address; 

forwarding the data packet to the second processor if it is determined that the first 
filter table does not include the at least one extracted destination address; 
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determining whether the first filter table includes the extracted source address if it 
is determined that the first filter table includes the at least one extracted destination 
address; 

forwarding the data packet to the second processor if it is determined that the first 
filter table does not include the extracted source address; 

identifying all network ports associated with the at least one destination address 
in the first filter table if it is determined that the first filter table includes the extracted 
source address; and 

forwarding the data packet to identified network ports . 

10. The method of claim 9, further comprising the step of: 

incrementing a discard counter if it is determined that the first filter table includes 
the extracted source address. 

1 1 . The method of claim 7 wherein the step of determining whether the extracted 
packet information is contained within a second filter table further comprises the steps of: 

determining whether the second filter table includes the extracted source address; 

creating a new entry in the second filter table if it is determined that the second 
filter table does not include the extracted source address; 

determining whether the second filter table includes the at least one extracted 
destination address; 

forwarding the data packet to all available network ports if it is determined that 
the second filter table does not include the at least one extracted destination address; 

identifying all network ports associated with the at least one destination address if 
it is determined that the second filter table includes the at least one extracted destination 
address; and 
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forwarding the data packet to identified network ports. 

12. The method of claim 11, further comprising the step of updating a timestamp in 
the second filter table associated with an extracted source address if it is determined that 
the second filter table includes the extracted source address. 

13. The method of claim 6, wherein the first filter table is in the form of a balanced 
binary tree. 

14. The method of claim 6, wherein the content and format of the first filter table are 
maintained by the second processor. 

15. A method for maintaining the first filter table of claim 2, comprising the steps of: 
determining, for a particular entry in the second filter table, whether a 

corresponding entry exists in the first filter table; 

determining whether space exists within the first filter table to add a new entry 
and maintain maximum search times below a predetermined limit if it is determined that 
a corresponding entry does not exist; 

determining whether, upon addition of a new entry, the height of the binary tree 
would exceed a predetermined limit if it is determined that space exists within the first 
filter table; 

rebalancing the binary tree if it is determined that, upon addition of a new entry, 
the height of the binary tree would exceed a predetermined limit; and 

inserting a new entry into the tree corresponding the particular entry in the 
second filter table. 
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